Executive brief
Oj, a high-performance JSON processing library for Ruby, contains a flaw that can expose sensitive information from a server's memory. When the library processes specially crafted JSON data with very long keys, it may inadvertently read and return internal system memory instead of the intended data. This could allow an attacker to see fragments of other data currently being processed by the application, potentially including sensitive configuration or user information.
Technical details
A vulnerability exists in the `form_attr()` function within `ext/oj/intern.c` of the Oj Ruby gem. When parsing JSON in `:object` mode, the library fails to correctly reference a newly allocated heap buffer for keys exceeding 253 bytes, instead passing an uninitialized stack buffer to `rb_intern3()`. For keys 254-255 bytes, this results in an uninitialized stack read; for keys 256 bytes or longer, it triggers an out-of-bounds read (CWE-125). An attacker can recover leaked stack memory if the application returns the resulting Symbol or the `EncodingError` message (triggered by invalid UTF-8 in the leaked memory) to the user. The issue is fixed in version 3.17.3.
Affected products
- ohler55 oj < 3.17.3
Timeline
- 2026-06-16: advisory: GitHub Security Advisory published by maintainer
- 2026-07-01: disclosed: NVD publication date
- 2026-06-16: patched: Fixed in version 3.17.3